bilt-toolkit 1.0.0

package/dist/core/fix/confirm.js

@@ -0,0 +1,60 @@
+// ─── Fix Confirmation Prompts ────────────────────────────────────────────────
+//
+// Interactive prompts to confirm destructive or irreversible fix actions.
+// Uses enquirer for terminal prompts.
+//
+// Three tiers:
+//   1. Safe actions      → no prompt, returns true immediately.
+//   2. Destructive       → simple y/n confirmation.
+//   3. Irreversible      → user must type the filename to confirm.
+// ─────────────────────────────────────────────────────────────────────────────
+import Enquirer from "enquirer";
+// enquirer's CJS default export needs this accessor in ESM
+const enquirer = new Enquirer();
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Prompt the user to type the filename to confirm an **irreversible** action.
+ *
+ * Used for actions like permanently deleting a file or rewriting git history
+ * where a simple y/n is not enough assurance.
+ *
+ * @param action   The fix action being applied.
+ * @param fileName The filename the user must type to confirm.
+ * @returns `true` if the user typed the correct filename, `false` otherwise.
+ */
+export async function requireTypedConfirmation(action, fileName) {
+    // Safe actions and test environment need no confirmation
+    if (action.type === "safe" ||
+        process.env.NODE_ENV === "test" ||
+        process.env.VITEST)
+        return true;
+    const response = (await enquirer.prompt({
+        type: "input",
+        name: "confirm",
+        message: `⚠️  This action is IRREVERSIBLE: ${action.description}\n` +
+            `   Type "${fileName}" to confirm:`,
+    }));
+    return response.confirm.trim() === fileName;
+}
+/**
+ * Prompt the user for a simple y/n confirmation for a **destructive**
+ * action.
+ *
+ * @param action The fix action being applied.
+ * @returns `true` if the user confirms, `false` otherwise.
+ */
+export async function requireSimpleConfirmation(action) {
+    // Safe actions and test environment need no confirmation
+    if (action.type === "safe" ||
+        process.env.NODE_ENV === "test" ||
+        process.env.VITEST)
+        return true;
+    const response = (await enquirer.prompt({
+        type: "confirm",
+        name: "confirm",
+        message: `Apply fix: ${action.description}?`,
+        initial: false,
+    }));
+    return response.confirm;
+}
+//# sourceMappingURL=confirm.js.map

package/dist/core/fix/confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm.js","sourceRoot":"","sources":["../../../src/core/fix/confirm.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,sCAAsC;AACtC,EAAE;AACF,eAAe;AACf,gEAAgE;AAChE,oDAAoD;AACpD,mEAAmE;AACnE,gFAAgF;AAEhF,OAAO,QAAQ,MAAM,UAAU,CAAC;AAGhC,2DAA2D;AAC3D,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;AAEhC,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiB,EACjB,QAAgB;IAEhB,yDAAyD;IACzD,IACE,MAAM,CAAC,IAAI,KAAK,MAAM;QACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM;QAElB,OAAO,IAAI,CAAC;IAEd,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,SAAS;QACf,OAAO,EACL,oCAAoC,MAAM,CAAC,WAAW,IAAI;YAC1D,YAAY,QAAQ,eAAe;KACtC,CAAC,CAAwB,CAAC;IAE3B,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAiB;IAEjB,yDAAyD;IACzD,IACE,MAAM,CAAC,IAAI,KAAK,MAAM;QACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM;QAElB,OAAO,IAAI,CAAC;IAEd,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,cAAc,MAAM,CAAC,WAAW,GAAG;QAC5C,OAAO,EAAE,KAAK;KACf,CAAC,CAAyB,CAAC;IAE5B,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC"}

package/dist/core/fix/env-fix.d.ts

@@ -0,0 +1,40 @@
+import type { ParsedEnvFile, SecretRule } from "../../types/index.js";
+/**
+ * Generate an `.env.example` file from a parsed env file.
+ *
+ * Secret values are replaced with descriptive placeholders while
+ * preserving the overall structure — comments, blank lines, ordering,
+ * and non-secret values are kept intact.
+ *
+ * @param envFile           Parsed env file to use as the template.
+ * @param rules             Secret rules for value classification.
+ * @param entropyThreshold  Entropy threshold for detecting secrets.
+ * @returns The generated `.env.example` content as a string.
+ */
+export declare function generateEnvExample(envFile: ParsedEnvFile, rules: SecretRule[], entropyThreshold: number): string;
+/**
+ * Add entries to a `.gitignore` file, skipping any that already exist.
+ *
+ * Reads the current content from disk, appends missing entries with a
+ * header comment, and returns the new content string.
+ *
+ * **Does NOT write to disk** — the caller is responsible for writing
+ * (this enables dry-run mode).
+ *
+ * @param entries       Patterns to add (e.g. `.env`, `.env.local`).
+ * @param gitignorePath Absolute path to the `.gitignore` file.
+ * @returns The updated `.gitignore` content.
+ */
+export declare function addToGitignore(entries: string[], gitignorePath: string): Promise<string>;
+/**
+ * Append stub entries for missing env vars to existing env file content.
+ *
+ * Adds a comment header and empty variable declarations for each
+ * missing variable.
+ *
+ * @param targetContent Existing env file content.
+ * @param missingVars   Variable names to add.
+ * @returns Updated env file content with missing vars appended.
+ */
+export declare function addMissingEnvVars(targetContent: string, missingVars: string[]): string;
+//# sourceMappingURL=env-fix.d.ts.map

package/dist/core/fix/env-fix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-fix.d.ts","sourceRoot":"","sources":["../../../src/core/fix/env-fix.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AA6DtE;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,UAAU,EAAE,EACnB,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAiDR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EAAE,GACpB,MAAM,CAoBR"}

package/dist/core/fix/env-fix.js

@@ -0,0 +1,186 @@
+// ─── Env Fix Utilities ───────────────────────────────────────────────────────
+//
+// Automated fixes for common .env-related findings:
+//   • Generate a safe .env.example with secrets stripped
+//   • Add missing entries to .gitignore
+//   • Append stub entries for missing env vars
+// ─────────────────────────────────────────────────────────────────────────────
+import fs from "node:fs/promises";
+import { isHighEntropy } from "../rules/entropy.js";
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+/**
+ * Check if a value matches any secret rule pattern.
+ */
+function matchesSecretRule(value, rules) {
+    for (const rule of rules) {
+        rule.pattern.lastIndex = 0;
+        if (rule.pattern.test(value))
+            return true;
+    }
+    return false;
+}
+/**
+ * Determine if a value should be treated as a secret and therefore
+ * stripped from the example file.
+ */
+function isSecretValue(value, rules, entropyThreshold) {
+    if (!value || value.length === 0)
+        return false;
+    if (matchesSecretRule(value, rules))
+        return true;
+    if (isHighEntropy(value, entropyThreshold))
+        return true;
+    return false;
+}
+/**
+ * Generate an appropriate placeholder based on the variable name.
+ */
+function placeholderFor(key) {
+    const lower = key.toLowerCase();
+    if (lower.includes("url") || lower.includes("uri"))
+        return "https://example.com";
+    if (lower.includes("host"))
+        return "localhost";
+    if (lower.includes("port"))
+        return "3000";
+    if (lower.includes("email") || lower.includes("mail"))
+        return "user@example.com";
+    if (lower.includes("password") || lower.includes("passwd"))
+        return "your-password-here";
+    if (lower.includes("key") ||
+        lower.includes("token") ||
+        lower.includes("secret"))
+        return "your-secret-here";
+    if (lower.includes("database") || lower.includes("db"))
+        return "your-database-here";
+    if (lower.includes("region"))
+        return "us-east-1";
+    if (lower.includes("bucket"))
+        return "your-bucket-name";
+    if (lower.includes("name"))
+        return "your-name-here";
+    return "your-value-here";
+}
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Generate an `.env.example` file from a parsed env file.
+ *
+ * Secret values are replaced with descriptive placeholders while
+ * preserving the overall structure — comments, blank lines, ordering,
+ * and non-secret values are kept intact.
+ *
+ * @param envFile           Parsed env file to use as the template.
+ * @param rules             Secret rules for value classification.
+ * @param entropyThreshold  Entropy threshold for detecting secrets.
+ * @returns The generated `.env.example` content as a string.
+ */
+export function generateEnvExample(envFile, rules, entropyThreshold) {
+    const outputLines = [];
+    // Process each raw line to preserve structure
+    for (const rawLine of envFile.rawLines) {
+        const trimmed = rawLine.trim();
+        // Preserve empty lines and comments as-is
+        if (trimmed === "" || trimmed.startsWith("#")) {
+            outputLines.push(rawLine);
+            continue;
+        }
+        // Strip optional `export ` prefix for parsing
+        const line = trimmed.startsWith("export ")
+            ? trimmed.slice(7).trim()
+            : trimmed;
+        const eqIdx = line.indexOf("=");
+        if (eqIdx === -1) {
+            // Not a key=value line — preserve as-is
+            outputLines.push(rawLine);
+            continue;
+        }
+        const key = line.slice(0, eqIdx).trim();
+        const entry = envFile.entries.get(key);
+        if (!entry) {
+            // Key not in entries map (shouldn't happen) — preserve line
+            outputLines.push(rawLine);
+            continue;
+        }
+        // Determine leading whitespace / export prefix for reconstruction
+        const prefix = trimmed.startsWith("export ") ? "export " : "";
+        if (isSecretValue(entry.value, rules, entropyThreshold)) {
+            // Replace the value with a placeholder
+            const placeholder = placeholderFor(key);
+            const comment = entry.comment ? ` # ${entry.comment}` : "";
+            outputLines.push(`${prefix}${key}=${placeholder}${comment}`);
+        }
+        else {
+            // Keep the original line
+            outputLines.push(rawLine);
+        }
+    }
+    return outputLines.join("\n");
+}
+/**
+ * Add entries to a `.gitignore` file, skipping any that already exist.
+ *
+ * Reads the current content from disk, appends missing entries with a
+ * header comment, and returns the new content string.
+ *
+ * **Does NOT write to disk** — the caller is responsible for writing
+ * (this enables dry-run mode).
+ *
+ * @param entries       Patterns to add (e.g. `.env`, `.env.local`).
+ * @param gitignorePath Absolute path to the `.gitignore` file.
+ * @returns The updated `.gitignore` content.
+ */
+export async function addToGitignore(entries, gitignorePath) {
+    let currentContent = "";
+    try {
+        currentContent = await fs.readFile(gitignorePath, "utf-8");
+    }
+    catch {
+        // File doesn't exist yet — start fresh
+    }
+    const existingLines = new Set(currentContent
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0 && !l.startsWith("#")));
+    const toAdd = entries.filter((entry) => !existingLines.has(entry));
+    if (toAdd.length === 0)
+        return currentContent;
+    // Build the addition block
+    const lines = [];
+    // Add a newline separator if the file doesn't end with one
+    if (currentContent.length > 0 && !currentContent.endsWith("\n")) {
+        lines.push("");
+    }
+    lines.push("# Added by bilt — environment files");
+    for (const entry of toAdd) {
+        lines.push(entry);
+    }
+    lines.push(""); // trailing newline
+    return currentContent + lines.join("\n");
+}
+/**
+ * Append stub entries for missing env vars to existing env file content.
+ *
+ * Adds a comment header and empty variable declarations for each
+ * missing variable.
+ *
+ * @param targetContent Existing env file content.
+ * @param missingVars   Variable names to add.
+ * @returns Updated env file content with missing vars appended.
+ */
+export function addMissingEnvVars(targetContent, missingVars) {
+    if (missingVars.length === 0)
+        return targetContent;
+    const lines = [];
+    // Ensure we start on a new line
+    if (targetContent.length > 0 && !targetContent.endsWith("\n")) {
+        lines.push("");
+    }
+    lines.push("");
+    lines.push("# Added by bilt — missing variables");
+    for (const varName of missingVars) {
+        lines.push(`${varName}=`);
+    }
+    lines.push(""); // trailing newline
+    return targetContent + lines.join("\n");
+}
+//# sourceMappingURL=env-fix.js.map

package/dist/core/fix/env-fix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-fix.js","sourceRoot":"","sources":["../../../src/core/fix/env-fix.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,oDAAoD;AACpD,yDAAyD;AACzD,wCAAwC;AACxC,+CAA+C;AAC/C,gFAAgF;AAEhF,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,gFAAgF;AAEhF;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAmB;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,KAAa,EACb,KAAmB,EACnB,gBAAwB;IAExB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEhC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChD,OAAO,qBAAqB,CAAC;IAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,OAAO,kBAAkB,CAAC;IAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxD,OAAO,oBAAoB,CAAC;IAC9B,IACE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAExB,OAAO,kBAAkB,CAAC;IAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpD,OAAO,oBAAoB,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEpD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,KAAmB,EACnB,gBAAwB;IAExB,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,8CAA8C;IAC9C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAE/B,0CAA0C;QAC1C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,8CAA8C;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,CAAC,CAAC,OAAO,CAAC;QAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,wCAAwC;YACxC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,4DAA4D;YAC5D,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,kEAAkE;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9D,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACxD,uCAAuC;YACvC,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,WAAW,GAAG,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,yBAAyB;YACzB,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAiB,EACjB,aAAqB;IAErB,IAAI,cAAc,GAAG,EAAE,CAAC;IAExB,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,cAAc;SACX,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAE9C,2BAA2B;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;IAEnC,OAAO,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,WAAqB;IAErB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAEnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,gCAAgC;IAChC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAElD,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;IAEnC,OAAO,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC"}

package/dist/core/fix/snapshot.d.ts

@@ -0,0 +1,30 @@
+import type { Snapshot } from "../../types/index.js";
+/**
+ * Create a snapshot of the specified files.
+ *
+ * Copies each file into `.bilt/snapshots/<id>/files/` preserving relative
+ * paths, and writes a `manifest.json` describing the snapshot.
+ *
+ * @param files       Absolute paths of files to snapshot.
+ * @param description Human-readable description (e.g. "Before gitignore fix").
+ * @param projectDir  Root directory of the project.
+ * @returns The created Snapshot.
+ */
+export declare function createSnapshot(files: string[], description: string, projectDir: string): Promise<Snapshot>;
+/**
+ * List all existing snapshots, sorted by timestamp (newest first).
+ */
+export declare function listSnapshots(projectDir: string): Promise<Snapshot[]>;
+/**
+ * Get the most recent snapshot, or `null` if none exist.
+ */
+export declare function getLatestSnapshot(projectDir: string): Promise<Snapshot | null>;
+/**
+ * Restore files from a snapshot back to their original locations.
+ *
+ * @param snapshotId  The snapshot ID to restore.
+ * @param projectDir  Root directory of the project.
+ * @returns `true` if the snapshot was found and restored, `false` otherwise.
+ */
+export declare function restoreSnapshot(snapshotId: string, projectDir: string): Promise<boolean>;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/core/fix/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/core/fix/snapshot.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,QAAQ,EAGT,MAAM,sBAAsB,CAAC;AAkF9B;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAmC3E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAG1B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/core/fix/snapshot.js

@@ -0,0 +1,186 @@
+// ─── Snapshot System ─────────────────────────────────────────────────────────
+//
+// Before applying destructive or irreversible fixes, Bilt creates a
+// snapshot of the affected files so the user can roll back.  Snapshots
+// are stored under `.bilt/snapshots/<id>/` with a `manifest.json` and
+// copies of every affected file.
+// ─────────────────────────────────────────────────────────────────────────────
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+// ─── Constants ───────────────────────────────────────────────────────────────
+const SNAPSHOTS_DIR = ".bilt/snapshots";
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+/**
+ * Resolve the snapshots root directory for a project.
+ */
+function snapshotsRoot(projectDir) {
+    return path.join(projectDir, SNAPSHOTS_DIR);
+}
+/**
+ * Resolve the directory for a specific snapshot.
+ */
+function snapshotDir(projectDir, id) {
+    return path.join(snapshotsRoot(projectDir), id);
+}
+/**
+ * Generate a short, unique snapshot ID based on timestamp + random suffix.
+ */
+function generateId() {
+    const ts = new Date().toISOString().replace(/[-:T]/g, "").slice(0, 14); // YYYYMMDDHHmmss
+    const rand = crypto.randomBytes(4).toString("hex");
+    return `${ts}-${rand}`;
+}
+/**
+ * Ensure a directory exists, creating it (and parents) if necessary.
+ */
+async function ensureDir(dir) {
+    await fs.mkdir(dir, { recursive: true });
+}
+/**
+ * Read the manifest.json from a snapshot directory.
+ * Returns null if the manifest is missing or invalid.
+ */
+async function readManifest(dir) {
+    try {
+        const raw = await fs.readFile(path.join(dir, "manifest.json"), "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Convert a manifest + its on-disk files into a full `Snapshot` object.
+ */
+async function hydrateSnapshot(manifest, dir) {
+    const files = [];
+    for (const relativePath of manifest.filePaths) {
+        try {
+            const content = await fs.readFile(path.join(dir, "files", relativePath), "utf-8");
+            files.push({ path: relativePath, content });
+        }
+        catch {
+            // File may have been deleted from the snapshot store — skip
+        }
+    }
+    return {
+        id: manifest.id,
+        timestamp: new Date(manifest.timestamp),
+        description: manifest.description,
+        files,
+    };
+}
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Create a snapshot of the specified files.
+ *
+ * Copies each file into `.bilt/snapshots/<id>/files/` preserving relative
+ * paths, and writes a `manifest.json` describing the snapshot.
+ *
+ * @param files       Absolute paths of files to snapshot.
+ * @param description Human-readable description (e.g. "Before gitignore fix").
+ * @param projectDir  Root directory of the project.
+ * @returns The created Snapshot.
+ */
+export async function createSnapshot(files, description, projectDir) {
+    const id = generateId();
+    const dir = snapshotDir(projectDir, id);
+    const filesDir = path.join(dir, "files");
+    await ensureDir(filesDir);
+    const snapshotFiles = [];
+    const filePaths = [];
+    for (const absPath of files) {
+        const relativePath = path.relative(projectDir, absPath).replace(/\\/g, "/");
+        try {
+            const content = await fs.readFile(absPath, "utf-8");
+            // Preserve directory structure inside the snapshot
+            const destPath = path.join(filesDir, relativePath);
+            await ensureDir(path.dirname(destPath));
+            await fs.writeFile(destPath, content, "utf-8");
+            snapshotFiles.push({ path: relativePath, content });
+            filePaths.push(relativePath);
+        }
+        catch {
+            // File might not exist (e.g. about to be created) — skip
+        }
+    }
+    const timestamp = new Date();
+    // Write manifest
+    const manifest = {
+        id,
+        timestamp: timestamp.toISOString(),
+        description,
+        filePaths,
+    };
+    await fs.writeFile(path.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+    return {
+        id,
+        timestamp,
+        description,
+        files: snapshotFiles,
+    };
+}
+/**
+ * List all existing snapshots, sorted by timestamp (newest first).
+ */
+export async function listSnapshots(projectDir) {
+    const root = snapshotsRoot(projectDir);
+    let entries;
+    try {
+        entries = await fs.readdir(root);
+    }
+    catch {
+        // No snapshots directory — nothing to list
+        return [];
+    }
+    const snapshots = [];
+    for (const entry of entries) {
+        const dir = path.join(root, entry);
+        // Skip non-directories
+        try {
+            const stat = await fs.stat(dir);
+            if (!stat.isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const manifest = await readManifest(dir);
+        if (!manifest)
+            continue;
+        const snapshot = await hydrateSnapshot(manifest, dir);
+        snapshots.push(snapshot);
+    }
+    // Newest first
+    snapshots.sort((a, b) => b.timestamp.getTime() - a.timestamp.getTime());
+    return snapshots;
+}
+/**
+ * Get the most recent snapshot, or `null` if none exist.
+ */
+export async function getLatestSnapshot(projectDir) {
+    const all = await listSnapshots(projectDir);
+    return all[0] ?? null;
+}
+/**
+ * Restore files from a snapshot back to their original locations.
+ *
+ * @param snapshotId  The snapshot ID to restore.
+ * @param projectDir  Root directory of the project.
+ * @returns `true` if the snapshot was found and restored, `false` otherwise.
+ */
+export async function restoreSnapshot(snapshotId, projectDir) {
+    const dir = snapshotDir(projectDir, snapshotId);
+    const manifest = await readManifest(dir);
+    if (!manifest)
+        return false;
+    const snapshot = await hydrateSnapshot(manifest, dir);
+    for (const file of snapshot.files) {
+        const destPath = path.join(projectDir, file.path);
+        await ensureDir(path.dirname(destPath));
+        await fs.writeFile(destPath, file.content, "utf-8");
+    }
+    return true;
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/core/fix/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../../src/core/fix/snapshot.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,iCAAiC;AACjC,gFAAgF;AAEhF,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AAOjC,gFAAgF;AAEhF,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,gFAAgF;AAEhF;;GAEG;AACH,SAAS,aAAa,CAAC,UAAkB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,UAAkB,EAAE,EAAU;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;IACzF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,QAA0B,EAC1B,GAAW;IAEX,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,EACrC,OAAO,CACR,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAe,EACf,WAAmB,EACnB,UAAkB;IAElB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE1B,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEpD,mDAAmD;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YACxC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/C,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,iBAAiB;IACjB,MAAM,QAAQ,GAAqB;QACjC,EAAE;QACF,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,WAAW;QACX,SAAS;KACV,CAAC;IAEF,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EACjC,OAAO,CACR,CAAC;IAEF,OAAO;QACL,EAAE;QACF,SAAS;QACT,WAAW;QACX,KAAK,EAAE,aAAa;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAe,EAAE,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEnC,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,SAAS;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,eAAe;IACf,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAExE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,UAAkB;IAElB,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAEzC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEtD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/rules/entropy.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Calculate the Shannon entropy (in bits-per-character) of a string.
+ *
+ * Shannon entropy is defined as:
+ *   H = -Σ p(x) · log₂(p(x))
+ *
+ * where p(x) is the frequency of character x in the string.
+ *
+ * Higher values indicate more randomness — typical English prose scores
+ * around 3.5–4.0 while random hex/base64 strings score 4.5–6.0+.
+ */
+export declare function calculateShannonEntropy(value: string): number;
+/**
+ * Determine whether a value is "high entropy" — i.e. random enough to
+ * plausibly be a secret key / token.
+ *
+ * Before running the entropy check the function applies several
+ * heuristics to avoid false positives:
+ *
+ * 1. Values shorter than 8 characters are skipped (too short to be a key).
+ * 2. Pure UUID strings are skipped (high-entropy but not secret).
+ * 3. Values that match common configuration words are skipped.
+ *
+ * @param value     The raw string value to analyse.
+ * @param threshold Minimum entropy (bits-per-char) to be considered
+ *                  "high". Defaults to **4.5**.
+ */
+export declare function isHighEntropy(value: string, threshold?: number): boolean;
+//# sourceMappingURL=entropy.d.ts.map

package/dist/core/rules/entropy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.d.ts","sourceRoot":"","sources":["../../../src/core/rules/entropy.ts"],"names":[],"mappings":"AA4DA;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmB7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,OAAO,CAgBrE"}